HTX denies USDT transfer under investigation

Sun Yuchen denied the HTX "dust attack" report, saying it was a fabrication of

HTX marketing director Liu Ye confirmed that an internal investigation had been launched into the same batch of transfers. On-chain verification found that the transfer destination was Kraken's address, not Coinbase as previously claimed. The EU's trading ban on HTX will take effect on August 23.

On August 18, Sun Yuchen told all those willing to listen that these reports were purely fabrications. That day, traders kept posting screenshots showing USDT deposits ranging from $7.5 to $12 from wallets marked as HTX by blockchain browsers, and then the exchanges where these deposits were located claimed that the accounts were restricted. The TRON founder responded on the X platform that the investigation had made it clear that the entire incident was fabricated. An independent on-chain verification later supported his claims in key details. Later that same day, HTX marketing director Liu Ye admitted that the community was concerned and confirmed that the exchange had formally launched an internal investigation to identify these suspicious transactions. The company does not investigate incidents that have been confirmed not to have occurred. The gap between the two statements was the most intriguing part of HTX this week, and it all came five days before the EU ban on exchange trading came into effect.

Sun Yuchen answered a question that no one asked

A closer reading of this denial will reveal that it targets "authorship" rather than "consequences." Sun Yuchen claimed that HTX did not send the funds. Liu Ye's investigation focused on whether transfers occurred and what impact they had on users. This is a completely different matter, and online records have reached a conclusion on this. Both positions can be held simultaneously, making the incident seem embarrassing rather than dishonest.

The exchange's own statement carried this tension in one breath: no transfers or testing activities were initiated through official channels, while verification work continued, including address tagging and on-chain origin identification. HTX also adds a technically sound point-blockchain browsers and analytics companies allocate tags through ownership statements and clustering, and a visible tag does not prove who authorized the payment. The statement did not mention any blockchains, sending addresses or transaction hashes.

Why tags may mislead money senders

Forensic platforms including Chainalysis and TRM Labs do not obtain wallet lists from exchanges. They infer ownership through behavior-such as Gas price setting, batch transfer rhythm, which deposit nodes addresses communicate with, how balances are collected, etc. Behavior can be replicated. If an attacker studies HTX's operating characteristics and imitates them, its address may be algorithmically classified into an exchange cluster, and the tag will then spread to all browsers and compliance dashboards that use the data source. The report mentioned a specific cluster called "HTX48", which at least provides a verifiable clue to the claim.

The trading model itself does not support the exchange-initiated assumptions. Withdraws usually follow user needs and generate irregular amounts and time intervals. What analysts observed was that within tight time windows, small transfers of $3 to $10 were repeatedly sent to unrelated addresses. This is a circular operation.

Publicly stated

Sun Yuchen (owner): The report is fabricated. HTX did not send any funds. -- Regarding the "author identity" of the transfer

Operational level

Liu Ye (marketing director): A formal internal investigation has been launched. -- Impact on users

Coinbase accounts that no one can find

Compliance software evaluates risk through relevance. When regulators add an entity to the list, intelligence providers recluster all addresses associated with it, and addresses that were clean on Monday may turn red on Tuesday, without any action being taken by the address owner. This mechanism is real, which is why the story spreads so quickly. Whether it really happened here is another matter.

The original allegations came from anonymous trader 0xZiye, who claimed that a USDT deposit of $7.5 led Coinbase to demand an explanation of the source of the funds and faced the threat of account closure. Community researcher 0xMoon tried to find out the deal. HTX said it could not track the transfer because 0xZiye refused to provide its deposit address on privacy grounds. So 0xMoon directly checked HTX Hot Wallet 48 and found that the $7.5 transfer was only sent to the Kraken address, and none of it entered the Coinbase account. There was also no second affected user, which is difficult to reconcile with the idea of a wave of systemic freezes. Sun Yuchen recognized these findings. 0xMoon was more cautious, pointing out that the original deposit address could resolve remaining questions, but the address had not yet been provided.

The precedents people cite do not provide the cover they imagine. After OFAC sanctioned Tornado Cash in 2022, activists sent contaminated ETH to well-known wallets including Jimmy Fallon. OFAC subsequently issued guidance stating that its rules do technically apply to these recipients, who need to file restricted property reports and may need permission to transfer funds. But concessions are limited: The agency said it would not prioritize deferred reporting without other sanctions. Enforcement discretion is not a finding of innocence and is only binding on regulators. As a private company, Coinbase still has the right to refuse any customer that may increase its own risk exposure.

Five days before the ban

May 26: The British FCDO places HTX on its sanctions list for US$1.5 billion in Kremlin-related transactions. August 18: Unsolicited transfers occur; users report exchange restrictions. August 18: Sun Yuchen denied that Liu Ye launched an investigation and on-chain verification found Kraken as the destination. August 23: The EU trading ban takes effect; Binance blocks HTX trading.

The corporate defense that HTX is really doing

Behind the denial, there is a hidden claim of jurisdiction. HTX argued that the UK sanctioned Huobi Global., This is a legal entity that HTX views as a different entity from the retail platform users use on a daily basis. Regulators have shown no interest in the distinction, and the EU measures due to take effect on Monday have made no exceptions. After that date, the discretion currently available to compliance officials will be narrowed. A marked deposit today only triggers a questionnaire. Within the EU next week, it will constitute a breach, while officials handling documents will have less room for judgment. Sun Yuchen told users that Binance's restrictions are only for UK and EU customers, a statement that comes from his conversation with Binance rather than any official statement issued by Binance. Anyone holding a balance on the platform faces a narrow window of time, and where the funds will then flow to-exchange accounts or wallets controlled by users themselves-will determine who needs to deal with compliance issues that follow a USDT transfer.

The broader pattern of "dust attacks" existed before this week's controversy and remains unexplained. No one can trace the source of funds behind these wallets. Whoever ran the script paid Gas fees for thousands of transfers, while a competitor trying to undermine HTX's remaining relationships, a group testing how quickly Western anti-money laundering infrastructure can target ordinary wallets, and a fraud gang harvesting live addresses all three possibilities equally fit the observed phenomena. Tracing the path the original deposits entered these capital wallets can distinguish the three. However, no institution has published relevant research so far.